In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Prevent user-triggered null deref on QP create Previously, the user QP creation path would only attempt to populate iwqp->iwpbl if the user-provided req.user_wqe_bufs field was non-zero. The problem is that iwqp->iwpbl is unconditionally dereferenced later on in irdma_setup_virt_qp. While there was a check for iwqp->iwpbl != NULL, this check would only occur if req.user_wqe_bufs was non-zero. The end result is that a user could send a zero user_wqe_bufs value and trigger a null ptr deref. Fix this by unconditionally calling irdma_get_pbl and bailing if it fails, similar to the CQ and SRQ paths.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Prevent user-triggered
    null deref on QP create Previously, the user QP creation path would only attempt to populate iwqp->iwpbl
    if the user-provided req.user_wqe_bufs field was non-zero. The problem is that iwqp->iwpbl is
    unconditionally dereferenced later on in irdma_setup_virt_qp. While there was a check for iwqp->iwpbl !=
    NULL, this check would only occur if req.user_wqe_bufs was non-zero. The end result is that a user could
    send a zero user_wqe_bufs value and trigger a null ptr deref. Fix this by unconditionally calling
    irdma_get_pbl and bailing if it fails, similar to the CQ and SRQ paths. (CVE-2026-68418)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - RDMA/irdma: Prevent user-triggered null deref on QP create Previously, the user QP creation path would     only attempt to populate iwqp->iwpbl if the user-provided req.user_wqe_bufs field was non-zero. The     problem is that iwqp->iwpbl is unconditionally dereferenced later on in irdma_setup_virt_qp. While there     was a check for iwqp->iwpbl != NULL, this check would only occur if req.user_wqe_bufs was non-zero. The     end result is that a user could send a zero user_wqe_bufs value and trigger a null ptr deref. Fix this by     unconditionally calling irdma_get_pbl and bailing if it fails, similar to the CQ and SRQ paths.
    (CVE-2026-68418)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
365768	Ubuntu 26.04 LTS : Linux kernel (Azure) vulnerabilities (USN-8888-1)	Nessus	Ubuntu Local Security Checks	Local	medium
365767	Ubuntu 26.04 LTS : Linux kernel vulnerabilities (USN-8887-1)	Nessus	Ubuntu Local Security Checks	Local	medium
365463	Ubuntu 26.04 LTS : Linux kernel (OEM) vulnerabilities (USN-8889-1)	Nessus	Ubuntu Local Security Checks	Local	medium
471179	Google: sys-kernel/cchost-kernel-6_12, sys-kernel/cchost-kernel-6_18, sys-kernel/csql-kernel-6_12, sys-kernel/csql-kernel-6_18, sys-kernel/lakitu-kernel-6_12, sys-kernel/lakitu-kernel-6_18, sys-kernel/lakitu-nc-kernel-6_12, sys-kernel/lakitu-nc-kernel-6_18: security update to 19999.44.21	Tenable Cloud Security	Google COS Security Checks	Local	medium
471179	Google: sys-kernel/cchost-kernel-6_12, sys-kernel/cchost-kernel-6_18, sys-kernel/csql-kernel-6_12, sys-kernel/csql-kernel-6_18, sys-kernel/lakitu-kernel-6_12, sys-kernel/lakitu-kernel-6_18, sys-kernel/lakitu-nc-kernel-6_12, sys-kernel/lakitu-nc-kernel-6_18: security update to 19999.44.21	Tenable Self-Hosted Container Security	Google COS Security Checks	Local	medium
471041	Google: sys-kernel/cchost-kernel-6_18, sys-kernel/csql-kernel-6_18, sys-kernel/lakitu-kernel-6_18, sys-kernel/lakitu-nc-kernel-6_18: security update to 20085.0.0	Tenable Cloud Security	Google COS Security Checks	Local	medium
471041	Google: sys-kernel/cchost-kernel-6_18, sys-kernel/csql-kernel-6_18, sys-kernel/lakitu-kernel-6_18, sys-kernel/lakitu-nc-kernel-6_18: security update to 20085.0.0	Tenable Self-Hosted Container Security	Google COS Security Checks	Local	medium
350138	openSUSE 16: cluster-md-kmp-64kb / cluster-md-kmp-azure / cluster-md-kmp-default / etc (openSUSE-SU-2026:21910-1)	Nessus	SuSE Local Security Checks	Local	high
347900	SUSE SLED15 / SLES15 : Security update for the Linux Kernel (SUSE-SU-2026:4254-1)	Nessus	SuSE Local Security Checks	Local	high
334342	Linux Distros Unpatched Vulnerability : CVE-2026-68418	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-68418

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

high

high

medium